CVE-2026-14617 | NousResearch hermes-agent up to 2026.4.30 Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity (Issue 27288)

A vulnerability identified as problematic has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity.

This vulnerability is listed as CVE-2026-14617. The attack may be initiated remotely. In addition, an exploit is available.

The project decided to not implement a dedicated fix: “[T]he analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path.”